quarkusio/quarkus · error · RuntimeException

More than one effective service account found for applicatio

Error message

More than one effective service account found for application 

What it means

In the same RBAC path of BaseKubeProcessor.createRbacDecorators, after filtering effective service accounts by target, more than one match is ambiguous: Quarkus refuses to guess which service account to use for the RBAC decorators and throws this RuntimeException naming the application.

Source

Thrown at extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/BaseKubeProcessor.java:408

        }

        // Add cluster roles from extensions
        Targetable.filteredByTarget(clusterRolesFromExtensions, target)
                .map(role -> new AddClusterRoleResourceDecorator(name,
                        role.getName(),
                        Collections.emptyMap(),
                        role.getRules().stream()
                                .map(RBACUtil::from)
                                .toList()))
                .forEach(context::add);

        // Retrieve SA for current target
        final var potentialSAs = Targetable.filteredByTarget(effectiveServiceAccounts, target).toList();
        if (potentialSAs.isEmpty()) {
            throw new RuntimeException("No effective service account found for application " + name);
        }
        if (potentialSAs.size() > 1) {
            throw new RuntimeException("More than one effective service account found for application " + name);
        }
        final var effectiveServiceAccount = potentialSAs.get(0);
        final var effectiveServiceAccountNamespace = effectiveServiceAccount.getNamespace();
        final var effectiveServiceAccountName = effectiveServiceAccount.getServiceAccountName();

        // Prepare default configuration
        String defaultRoleName = null;
        boolean defaultClusterWide = false;
        boolean requiresServiceAccount = false;
        if (!roles.isEmpty()) {
            // generate a role binding using this first role.
            defaultRoleName = roles.iterator().next();
        } else if (!clusterRoles.isEmpty()) {
            // generate a role binding using this first cluster role.
            defaultClusterWide = true;
            defaultRoleName = clusterRoles.iterator().next();
        }

View on GitHub (pinned to e1c734241f)

Solutions

1. Ensure exactly one effective service account matches the current target; remove or scope the duplicates
2. Use %prod/%test style qualifiers so only one SA entry applies per target
3. Check extensions contributing service accounts and disable the redundant one
4. Build for a single target (e.g. -Dquarkus.kubernetes.deployment-target=kubernetes) to avoid cross-variant SA duplication

Example fix

# before
quarkus.kubernetes.service-account.name=sa-a
quarkus.openshift.service-account.name=sa-b
# after
quarkus.kubernetes.service-account.name=sa-a

// ensure exactly one SA matches target
long matches = serviceAccounts.stream().filter(sa -> sa.matchesTarget(target)).count();
if (matches != 1) fail("expected exactly 1 effective service account for " + target);

When it happens

Trigger: Multiple effective service accounts resolve for the same target — e.g. a default SA plus a named one both matching 'prod', or service-account config duplicated across scopes that all apply to the active target.

Common situations: Setting both quarkus.kubernetes.service-account.name and another SA-contributing extension/config (e.g. an extension adding its own SA) without exclusions; duplicate keys in service account config with different targets that overlap; combining quarkus.kubernetes with a variant (openshift/minikube) config each providing an SA for the same target key.

Related errors

• No effective service account found for application
• No role has been set in the RoleBinding resource!
• No subjects have been set in the ClusterRoleBinding resource
• More than one ApplyServiceAccountNameDecorator found
• Unable to obtain configuration for Secret objects from Kuber

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/83a607a9fbffc60b. Report an issue: GitHub.